CVE-2026-73285: RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing maybemergeobjecttagconditions to omit s3:ExistingObjectTag/ values and allowing authenticated users to bypass tag-based policy restrictions. This issue is fixed in version 1.0.0-rc.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RustFSto a version that resolves this vulnerability.Fixed in 1.0.0-rc.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73285?
CVE-2026-73285 has a high severity rating of 7.5.
How do I fix CVE-2026-73285?
To fix CVE-2026-73285, update RustFS to a version greater than 1.0.0-rc.1.
What impact does CVE-2026-73285 have on my system?
CVE-2026-73285 allows tagged objects to be treated as untagged, potentially compromising authorization policies.
What versions of RustFS are affected by CVE-2026-73285?
RustFS versions from 1.0.0-alpha.64 up to 1.0.0-rc.1 are affected by CVE-2026-73285.
Is CVE-2026-73285 exploitable remotely?
Yes, CVE-2026-73285 is exploitable remotely due to the nature of the vulnerability.